Advisories · Technology
mbedtls.
Every CVE that names mbedtls among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.0 Medium
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
- mbedtls
- CWE-385
- CVSS 4.0 Medium
mbedtls: Mbed TLS before 3.6.4 has a NULL pointer dereference because…
- mbedtls
- CWE-696
- CVSS 8.9 High
Use after free in mbedtls
- mbedtls
- Memory corruption
- CVSS 4.8 Medium
Off-by-one error in mbedtls
- mbedtls
- CWE-193
- CVSS 7.8 High
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur.
- mbedtls
- CWE-733
- CVSS 4.8 Medium
Out-of-bounds read in mbedtls
- mbedtls
- Memory corruption
- CVSS 4.9 Medium
mbedtls: In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash…
- mbedtls
- CWE-325
- CVSS 5.4 Medium
Use of uninitialized resource in mbedtls
- mbedtls
- Memory corruption
- CVSS 5.4 Medium
mbedtls: Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side…
- mbedtls
- CWE-1188